PR looks fine. Will have to check into whether/how dependabot can be added to the repo under the github org. Not 100% sure on the status of that as it transitions from a 3rd party "preview" app to a first class GitHub thing.

Does it allow you to light up repos at https://app.dependabot.com ?

Does it allow you to light up repos at https://app.dependabot.com ?

Wasn't sure I'd have enough access to add it to the GitHub org, but looks like I do, at least for this repo.

Looks like it's running now with defaults, but from what I can tell it's finding requirements-dev.txt and not requirements.txt. Will see what the PR it opens up looks like when it's finished.

Looks like it pulled stuff from both:

Recording for posterity:

Applied config from .dependabot/config.yml:

---
update_configs:
- directory: "/"
  package_manager: python
  update_schedule: weekly
In addition, the following defaults have been applied:

---
allowed_updates:
- match:
    update_type: all
    dependency_type: direct
- match:
    update_type: security
    dependency_type: indirect
automerged_updates: []
default_assignees: []
default_labels:
- dependencies
default_reviewers: []
ignored_updates: []
target_branch: master
version_requirement_updates: auto

My sense is that it only keeps open about 10 PRs and then it stops until the next cycle.